Merge pull request #1371 from t-woerner/dns_over_tls

ipaserver, ipareplica and ipaclient roles: Add DNS over TLS support

roles/ipareplica/module_utils/ansible_ipa_replica.py

@@ -187,6 +187,14 @@ try:
             from ipaserver.install import ntpinstance
             time_service = "ntpd"  # pylint: disable=invalid-name
 
+        try:
+            CLIENT_SUPPORTS_NO_DNSSEC_VALIDATION = False
+            from ipaclient.install.client import ClientInstallInterface
+        except ImportError:
+            pass
+        else:
+            if hasattr(ClientInstallInterface, "no_dnssec_validation"):
+                CLIENT_SUPPORTS_NO_DNSSEC_VALIDATION = True
     else:
         # IPA version < 4.6
         raise RuntimeError("freeipa version '%s' is too old" % VERSION)
@@ -339,12 +347,6 @@ options.add_agents = False
 options.subject_base = None
 options.ca_subject = None
 
-# Hotfix for https://github.com/freeipa/freeipa/pull/7343
-options.dns_over_tls = False
-options.dns_over_tls_key = None
-options.dns_over_tls_cert = None
-options.dot_forwarders = None
-options.dns_policy = None
 # pylint: enable=attribute-defined-outside-init